# Privacy policy

Stochastly processes the personal data described below under the EU General Data Protection Regulation and the French Data Protection Act.

Last updated October 2026Regulation (EU) 2016/679

## Who is responsible

The data controller is Mahé Chadeffaud, a sole proprietor trading as Stochastly, 7 rue Marie-Thérèse Hermann, 74000 Annecy, France, SIREN 109 270 363, reachable at contact@stochastly.com. The scope is stochastly.com, the Stochastly desktop application, and the licences issued through them.

No data protection officer is appointed; our processing does not require one (Art. 37 GDPR). Write to contact@stochastly.com for any data-protection request.

This policy applies wherever you live. Because we are established in France, the GDPR governs our processing for every user, inside the European Union and outside it, and you have the rights below whatever your country.

## Data and legal basis

Each row below names one processing operation, the data it uses, its purpose and its legal basis under Art. 6(1) GDPR.

- Legacy waitlist emails. Previously submitted email addresses, submission times and source labels were collected with consent under Art. 6(1)(a). Contact us to request removal.
- Purchase. Payment is taken by Stripe, which sends us the buyer email and the checkout or subscription identifier. We do not receive or store your card number. Legal basis: performance of the contract, Art. 6(1)(b). If purchase review invitations are enabled, we send a purchase confirmation via Resend and copy the buyer email address to Trustpilot so it can send one neutral review invitation after the configured delay. Your licence is never sent to Trustpilot. This optional satisfaction follow-up is based on our legitimate interest in improving our service, Art. 6(1)(f); you may object at contact@stochastly.com and unsubscribe from the invitation email.
- Country checks. Cloudflare supplies an IP country code. We use it to check purchase and trial availability, and we read the billing country in Stripe payment events. Excluded purchases are logged with their country, reason and payment reference; missing country evidence is also logged for review. Purpose: to enforce our availability policy and investigate failures, under our legitimate interests, Art. 6(1)(f). Server logs rotate by size, up to 50 MB per container; they have no fixed retention period in days. Stripe retains billing details under its own policy. These checks do not establish residence or reliably identify occupied territories or listed persons.
- Licence record. For each licence we hold the email, the edition, the licence identifier, its expiry, the Stripe reference, and any revocation and its reason. Purpose: to issue, support and revoke the licence. Legal basis: Art. 6(1)(b).
- Account. When you sign in with GitHub, Google or an emailed link, we store your email address, whether it is verified, the sign-in provider and its account identifier, and the times of creation and last sign-in. Licences bought with a verified email that matches, or bought while signed in, are attached to the account. When the desktop app is connected to your account, we store a one-time connection code, a hash of the app secret, the machine fingerprint, and the approval time; the code expires after ten minutes, and an hourly job deletes it once it has been expired for a day. For each computer linked to a licence, up to two, we store the machine fingerprint, a hash of the secret the app received when it was linked, an optional label, and the times it was linked and last seen. Each release of a computer is recorded with its date, to apply the limit of three releases per 30 days. Purpose: to let you find your licences, release a computer, and connect the app by signing in. Legal basis: performance of the contract, Art. 6(1)(b).
- Early access. When you join the early access, we store your account identifier, the date, your answers to the five questions (each one can be skipped), and the time your 100 assistant credits, offered once, were granted. The app asks for those credits. To give them once per computer, we keep a SHA-256 hash of the machine fingerprint, which stays after the account is deleted, so that deleting and joining again does not give the credits twice; to give them once per network per day, we keep for the current day a keyed digest of your network block (the first three parts of an IPv4 address, the first four groups of an IPv6 address), never the address itself, deleted the next day. Legal basis: our legitimate interest in preventing abuse of free credits, Art. 6(1)(f). Purpose: to give you the free licence for one computer, to send you a receipt and the feedback requests, and to understand who uses Stochastly so we can decide what to build. Only the Stochastly team sees the answers: a daily summary goes to our team mailbox, and they are listed in our administration console. Legal basis: performance of the contract, Art. 6(1)(b), for the licence, the receipt and the feedback requests; our legitimate interest in improving the product, Art. 6(1)(f), for the answers, which you may object to at contact@stochastly.com. The five questions are optional; skipping them changes nothing. To keep the free licences from being claimed in bulk, each request is counted for the current day by the domain of your email address and by a keyed digest of your network block (the first three parts of an IPv4 address, the first four groups of an IPv6 address), never the address itself; these counters are deleted the next day. A request above the daily thresholds waits, with its answers, for a manual review by the Stochastly team before the licence is issued. Legal basis: our legitimate interest in preventing abuse of a free offer, Art. 6(1)(f). The feedback you write is kept while your account exists and used to improve the product, Art. 6(1)(b).
- Free trial. When the app starts a free trial, we store your account identifier, a SHA-256 hash of your email address, a SHA-256 hash of the machine fingerprint, the identifier of the trial licence, its start and end times, and the time the trial credits were granted. Purpose: to offer one trial per person and per computer. Legal basis: performance of the contract, Art. 6(1)(b), and our legitimate interest in preventing repeated trials, Art. 6(1)(f).
- Licence check. A signed-in installation contacts our licence endpoint about every 1 hour on its own while it is open, and at each sign-in. It sends the licence token, the machine fingerprint and the secret the app received when it was linked; we update the time the computer was last seen, and when the check is refused we store the fingerprint, the licence identifier, the reason and the day (see Account and licence activity). Purpose: to check that the computer is one of those linked to the plan, to enforce revocation, and to issue the signed authorisation that keeps the app working offline. Legal basis: our legitimate interest in preventing licence sharing, Art. 6(1)(f).
- The machine fingerprint. It is a truncated SHA-256 hash of your operating system name and processor architecture, combined on Windows with your computer name and network adapter address, and on macOS with the platform identifier the system assigns at installation. The hash does not let us read those values back. It does identify your installation over time, which makes it pseudonymised personal data under Art. 4(5) GDPR, and this policy covers it as such.
- Assistant allowance. When the assistant is used, we increment a monthly counter holding the licence identifier, the calendar month, the input and output token totals, the number of calls and the credits charged, and a daily counter (licence, day, tokens, calls) that enforces the daily limit, deleted after 35 days. The Assistant + Agents option is recorded on your licence record: whether the option is active, the credit balances (the credits included for the current month, the credits you bought, and the amount reserved while a call is running), the identifier of the subscription that carries the option, and the date of the last change. Each credit top-up is recorded with the payment session identifier, the licence identifier, the number of credits and the date, so that a payment can never be credited twice. We also record the payment state Stripe reports for each subscription (paid, failed, refunded, disputed, paused or cancelled), to suspend, revoke or restore the licence it pays for, together with the identifiers of the Stripe events and invoices already processed, so that none is applied twice. The credits offered with a free trial opened before access became private are recorded on the trial licence in the same way. Purpose: to apply the allowance sold with the option and show you what remains. Legal basis: Art. 6(1)(b); for the daily counter, our legitimate interest in stopping a copied licence from using a month of allowance in one day (Art. 6(1)(f)).
- Account and licence activity. We count, without looking at any one person, how many accounts signed in on each day, week and month, from the sign-in times and the assistant counters described above. Only totals of ten or more are shown, and only to the Stochastly team; a smaller total is hidden, and no activity is shown for any single account. Legal basis: our legitimate interest in knowing how many people use the service, Art. 6(1)(f), after checking that this use is compatible with the reason the data was collected (Art. 6(4)). You can object by writing to contact@stochastly.com; your account is then left out of these totals. Two more records serve narrower purposes. Refused licence checks: when a check is refused (licence revoked or ended, or a computer that is not linked), we keep one line per licence, reason and day, with the machine fingerprint and the number of attempts, to detect fraud and licence sharing; a check that succeeds is not logged; legal basis Art. 6(1)(f); kept 12 months, then deleted by a daily job. Download counters: each installer our server sends adds one to a daily total per system (Windows or Mac), source (account page or in-app update) and app version, with no account, IP address or browser stored, to know how many installers go out; legal basis Art. 6(1)(f); kept 25 months, then deleted by a daily job.
- Enterprise enquiries. If you request a quote, we receive your company name, work email, team size and description of use. The site sends these details through Resend to our contact mailbox so we can reply. This is a step you request before a possible contract (Art. 6(1)(b)). You can ask us to delete the correspondence at contact@stochastly.com.
- Newsletter. If you subscribe, we store your email address, subscription status, the version of the consent text, the time you agreed, the time you confirmed and where you signed up. Purpose: to send release notes and research paper summaries. Legal basis: your consent (Art. 6(1)(a)); you can withdraw it in one click from any email, without affecting earlier sends. We also count subscribers, new sign-ups and unsubscribes per day and per week, including from the records kept after you unsubscribe, to see how the newsletter grows. Only totals of ten or more are shown, only to the Stochastly team, and never for any one person. Legal basis: our legitimate interest in measuring growth, Art. 6(1)(f), after checking that this use is compatible with the reason the data was collected (Art. 6(4)). You can object at contact@stochastly.com; your address is then left out of these totals. Recipients: Supabase (database, EU region) and Resend, Inc. (sending), our processors. Resend processes data in the United States under the Standard Contractual Clauses of its data processing agreement. We use no open or click tracking. Retention: unconfirmed sign-ups are deleted when the confirmation link expires (7 days); a subscription ends when you unsubscribe; after that we keep only a keyed hash of your address, the dates and the consent version for 3 years so we never email you by mistake, then delete them.
- Creator program. If you join it, we store your account identifier and email address, your creator code, the identifier of its Stripe promotion code, the identifier of your Stripe Connect account once you open one, your status in the program, and each commission and payout: amount, invoice identifier, date and Stripe transfer identifier. Stripe collects the identity and bank details needed to pay you, as its own controller; we do not receive them. When a customer pays with a creator code, we record their email address, plan, billing period, whether the referral is eligible or refused and the reason, and the share of each invoice kept after a refund or dispute. The creator sees counts and amounts, never who bought. While the program is open, each paid subscription invoice also stores the card fingerprint Stripe supplies, a token that recognises the same card without revealing its number, with the subscription reference, so that a card already used on another subscription earns no commission. Purpose: to pay creators as the creator terms state and to prevent self-referral. Legal basis: performance of the contract with the creator, Art. 6(1)(b), and our legitimate interest in preventing commission fraud, Art. 6(1)(f).
- Request throttling. The licence validation route, the sign-in routes (provider sign-in, emailed link, callback, session refresh), the app connection routes (start, check, approval), the app account and trial-credit routes, the computer release form, the creator program sign-up and payout-account forms, the assistant relay, the browser security-report endpoint and the legacy waitlist endpoint count recent requests per IP address to stop floods; the emailed-link form also counts requests per email address, the approval form per account, and the assistant relay and the app account and trial-credit routes per licence. The health check, the payment webhook, the monthly creator payout job and the retired activation route do not count IP addresses. That counter lives in memory, resets when the process restarts, and is written to no database. Legal basis: our legitimate interest in keeping the service available, Art. 6(1)(f).
- Server logs. Our host and our network provider record standard access logs, which include the IP address, the timestamp and the requested path. Purpose: security and abuse investigation. Legal basis: Art. 6(1)(f).
- Audience measurement. To count visits and see which pages are read, the pages of stochastly.com load Umami, an open-source counter that we run on our own server at stats.stochastly.com. No other company receives this data, apart from our host and our network provider, who carry it like any other request. For each page viewed it records the page address, the address of the page you came from, the page title, the browser, operating system, device type, screen size and language, and the country, region and city of the connection. Addresses are recorded without their query string, utm_ campaign tags included, and without any #fragment; a referring page on another site is reduced to its domain. Our server shortens the IP address before the counter receives it (the last of the four numbers of an IPv4 address is set to 0, an IPv6 address keeps its first three groups). The country, region and city are the ones our network provider attaches to the request or, failing that, are looked up from the shortened address. No IP address is stored: the shortened one is combined with the browser's user agent and a secret that changes every month into a visitor identifier, so a visitor cannot be followed from one month to the next. The sign-in pages and our own administration pages are not measured. You can object at any time: Stop measuring my visits. This stores one value, umami.disabled, in your browser so the choice is kept; Do Not Track and Global Privacy Control are also honoured. Your visits are not measured on this browser. Resume measuring my visits removes that value. Purpose: visit statistics for this site, never used for advertising or combined with other data. Legal basis: our legitimate interest, Art. 6(1)(f). It is set up to meet the conditions under which the French data protection authority (CNIL) exempts audience measurement from consent: no cookie, statistics for this site only, data kept 25 months at most. When an account has just been created, the page that follows sends one event named signup. The join path (the /join page, the five questions and the download buttons) sends one event per step reached, such as a question shown or skipped, the answers sent, or Download for Windows or Mac clicked. These events are names only: they carry no account identifier, email, name, answer or campaign, and only count steps. The app window of the home page sends one event per CSV check whose name gives how the check ended (checked, file not read, file too large, too many checks, server error), the page and a range of rows, such as csv_check_ok_landing_r30_249; it never names the file or anything in it.

The site sets cookies of its own only when you sign in: two session cookies that keep you signed in (one expires within a day, the other after thirty days or when you sign out), and, for ten minutes during sign-in, two cookies that carry the sign-in verifier and the page to return to. These are strictly necessary for the account you asked for, readable by our server only (HttpOnly), and never used for tracking. One more cookie, stx_in, holds the value 1 and no identifier, and expires after thirty days or when you sign out: the page header reads it in your browser to show Account instead of Log in, and our server never reads it. The site keeps at most two values in your browser's local storage. stx-polices is set to 1 once the site fonts are in your browser cache so the next page can show them at once. umami.disabled is set to 1 only if you object to audience measurement, so the choice is kept. Neither holds an identifier, our server never reads them, and sign-in adds nothing to them. The audience measurement itself sets no cookie and writes nothing else to your browser's storage. In the desktop application, bx.settings keeps your display preferences (theme, colours, text size) on your device, with your other application settings (the display name you choose, the assistant options and the data folders you add); our server never reads it. The site sets no advertising cookie and no third-party tracking cookie. That statement covers the pages served from stochastly.com; our network provider sets its own operational cookies.

## The licence check is automated

The licence check runs without a human reviewing it. If the server reports the licence as revoked or ended, or this computer as not linked to it, the licence stops granting its edition. That outcome affects a contract you have paid for, which is why it is written out under Art. 22 GDPR.

To contest such an outcome, obtain human review or explain a machine change, write to contact@stochastly.com. A server error does not revoke anything on its own: the application keeps its edition offline for the grace period set out in the Terms. Past that period it stops granting the edition until a check succeeds, and the first successful check restores it.

## Who else processes it

We do not sell or rent your data, and we do not share it for marketing. The providers below process it on our instructions, each under a data-processing agreement.

- Contabo hosts the site, and Cloudflare sits in front of it for TLS, caching and abuse filtering. Both see request metadata; Cloudflare terminates TLS.
- Supabase holds the database and runs the licence endpoint. Every table listed above lives there, behind row-level security that grants access to our server key alone. Our Supabase project is hosted in its West EU (Ireland) region, on AWS eu-west-1.
- GitHub and Google authenticate you when you choose them to sign in, as their own controllers for that step; they send us your email address and account identifier. Supabase also runs the sign-in service.
- Resend sends the emailed sign-in links and the emails about your account on our behalf, and receives your email address, and for early access your answers, for that purpose.
- Stripe takes the payment and holds the payment instrument, as its own controller for that part. For the creator program, Stripe Connect opens the creator's payout account, verifies their identity and sends the payouts.
- Nebius B.V. (Nebius Token Factory) receives assistant conversations, and only those, as our processor. See the next section.
- Linear (Linear Orbit, Inc.) holds our issue tracker. When you send a bug report or a crash report from the app, it receives a title, the app version, the operating system and the crash fingerprint, and never the text you wrote, the details attached or anything that identifies you. See crash reports and bug reports below.

Several of these providers are United States companies, or can process data outside the European Union depending on the region we run in. Where one of the providers above processes data outside the European Economic Area, the transfer relies on the safeguards of that provider's data-processing terms, such as the EU-US Data Privacy Framework or the Standard Contractual Clauses. The assistant's model provider is described in the next section. You can ask us at contact@stochastly.com which safeguard applies to a given provider.

## The desktop app, and the assistant

The desktop application reads and computes your market data, backtests and results on your own machine. Unless you tick one of the two optional boxes described in the next section, none of that is sent to us, on any plan — we hold no copy of your bars, your strategies or your performance. By default the application sends one daily usage summary with no identifier (see Product analytics); it never sends your market data, strategies or results.

Apart from the optional sharing described in the next section, two things leave the machine on their own: the licence check described above runs on a timer, and the daily usage summary described under Product analytics. The app ships no market data and downloads none: the bar files it reads are the files you put on your disk, and they are read there.

The assistant is the one feature that sends content off your machine. When it answers, the content of your conversation — which can include the graph you have composed and the file you have open in the editor — is sent to our relay and forwarded to a model provider. Bar files and result files are not uploaded as files; figures that the assistant quotes from a run you ask it to read travel in that conversation.

- Turning it off. The assistant is switched off from Settings, under “Enable assistant”. While it is off, nothing is sent to the relay.
- What our relay keeps. Conversation content is not written to our database. The record kept is the monthly token counter described above, so that your allowance can be enforced and shown to you.
- The model provider. The assistant is an AI system: its replies are generated by a language model, not written by a person, and they can be wrong. The model is DeepSeek V4 Flash, an open-weight model, run for us by Nebius B.V., a company established in the Netherlands, through its Nebius Token Factory service. Nebius acts as our processor under Art. 28 GDPR, bound by its [data processing agreement](https://docs.nebius.com/legal/dpa): it receives the conversation content described above for one purpose, generating the assistant's replies. DeepSeek, the company that published the model, receives nothing from us. Nebius states that it does not use this content to train any model. Unless zero data retention is enabled on our Nebius account, Nebius keeps prompts and replies to speed up later answers, a technique called speculative decoding, and stores them in Finland, in the European Union; with zero data retention, nothing is kept once the request is processed. The processing location itself is not fixed: Nebius runs the model in data centres that can be in the European Economic Area, the United Kingdom, Israel, the United States or Canada, as listed in its [Token Factory sub-processor list](https://docs.nebius.com/legal/sub-processors_tofa). A transfer outside the European Economic Area relies on an adequacy decision of the European Commission (United Kingdom, Israel) or on the Standard Contractual Clauses incorporated in Nebius's data processing agreement; Nebius is also certified under the EU-US Data Privacy Framework. If you prefer that no content leaves your machine, keep the assistant switched off.

## Optional data sharing from the desktop app

The app's sign-in screen shows three optional boxes: the two described in this section, and the crash-report box described under Crash reports and bug reports below. Clicking Sign in accepts the Terms of Use; this policy informs you, it is not something you consent to. The three boxes start unticked, are never required, and each covers one purpose only. The two described here send information produced on your computer, so they need your consent (Art. 82 of the French Data Protection Act, which applies Art. 5(3) of the ePrivacy Directive; Art. 6(1)(a) GDPR): that consent is the legal basis for both, and refusing or withdrawing it changes nothing in what the app does for you. Neither ever contains your account, your email address, your name, or your market data files. Each record does carry a random install identifier, which is what lets you erase it later: the records are therefore pseudonymous rather than anonymous, and we treat them as personal data. We never sell either set of data.

### Purpose 1: the public research counter

Box: “Add my GO/NO-GO verdicts to Stochastly's public research counter (verdict, market family, day and app version, sent under a random ID with no name, email or account)”. When it is ticked, each completed full backtest whose verdict is GO or NO-GO sends five research fields to stochastly.com: a random install identifier created when you tick the box and tied to nothing else, the verdict, the market family (crypto, foreign exchange, equities, stock indices, metals, commodities, mixed or other), the day of the run in UTC, and the app version. Preview passes, results replayed from the app's cache, and other verdicts send nothing. The totals are published on [the research verdicts page](https://stochastly.com/research/verdicts) as counts per market family; no individual record and no install identifier is ever shown.

### Purpose 2: internal model training

Box: “Let Stochastly use descriptions of my backtests (graph, settings, metrics and verdict; no price data, code, name or email) to train its own models. Internal use only, never sold.” When it is ticked, each completed full backtest sends a description of the run: the structure of the graph and its node parameters, the market family and instrument symbols, the timeframe, the first and last date and the number of bars, the cost settings, the metrics, the verdict and the diagnostics, with the app version and a second random install identifier, distinct from the first so the two sets cannot be joined. The app removes before sending, and our server refuses if still present: price series, equity curves, trade journals, code you wrote, file and folder paths, free-text notes and labels, and any email address. Only Stochastly uses this data, to research and train its own models; it is never shared with a third party. With each record of either purpose, the app also sends its licence token and computer identifier: our server checks them so that only a licensed copy of the app can add records, then discards them. They are never stored with the record; the daily limit per licence is counted under a keyed digest that changes every day and is deleted the next day. The app also sends a deletion secret drawn on this computer, of which our server keeps only a hash next to the record.

- Where it is stored. In our Supabase database (see who else processes it), in two separate tables, one per purpose, readable by our server key alone. The database is hosted in the European Union, in Supabase's West EU (Ireland) region on AWS eu-west-1. Supabase's data processing addendum commits it to store and primarily process the data in that region; where Supabase or one of its sub-processors reaches it from outside the European Economic Area, for support or operations, the transfer relies on the Standard Contractual Clauses of Commission Decision (EU) 2021/914, which that addendum incorporates.
- How long. Three years, counted from the day of the run for a verdict and from receipt for a backtest description; records past that age are deleted by the database every day. Why three years: the counter is only meaningful across several market regimes and app versions, and a model trained on backtests has to be retrained and checked against data from that same span. A shorter period would empty both before they could be read; a longer one is not needed for either.
- How to stop. Each box is turned off on its own in the app, Settings, General, under Data sharing. Turning one off stops its sending at once.
- How to erase. Once a box is off, the same place offers “Delete records already sent”: the app asks our server to delete records carrying both that computer's install identifier and its separate deletion secret for that purpose. Records sent by older app versions without a deletion secret are erased on request to contact@stochastly.com: the app shows the install identifier to quote, because the records carry no account and an email address alone cannot identify them.

## Product analytics

Usage statistics (on by default, you can turn them off). Once a day, the desktop app sends one summary of the previous days' use: which screens were opened, which features were used and how many times, the active minutes per screen, crash counts, the app version and the major version of your operating system. The app also adds flags it computes on your computer: whether this is the first active day of the week or of the month, the week the app was installed, and whether a first backtest was run within 72 hours of installation. The summary carries no identifier of any kind: no account, no licence, no machine fingerprint, no install ID, no file, price, strategy or text you typed. Our server splits each summary into separate counters as soon as it arrives and does not keep the summary itself, so no counter can be traced back to one computer; it does not store your IP address. Purpose: counts of active computers per day, week and month, which features are used and for how long, and where the app fails, so we can decide what to improve. These statistics are published to the Stochastly team only, rounded to the nearest ten, and never combined with your account, your early-access answers or any other data. Legal basis: our legitimate interest, Art. 6(1)(f) GDPR; this measurement is set up to meet the conditions under which the French data protection authority (CNIL) exempts audience measurement from consent. Stored in our Supabase database (EU, Ireland) for 25 months, then deleted by a daily job. You can object at any time: Settings, General, Data sharing, turn off “Usage statistics”. The app remembers this choice across updates and stops sending at once.

## Crash reports and bug reports

The desktop app has a Report a bug button (in the title bar, and in a corner of the sign-in screen) and a Send this report button on its error screens. A report leaves your computer only when you press Send in the dialog that opens, after the dialog has shown you every line that will be attached. On the sign-in screen, a third optional box, unticked by default, reads: Send crash reports automatically to Stochastly. It sends the full crash report described below, linked to your account, to fix crashes. The same choice is in Settings, General, Data sharing, as Full crash reports, where you can tick or untick it at any time. Only if it is ticked does the app send a full crash report on its own after a crash.

- What a bug report contains. The text you typed, and unless you untick Attach these details: the app version, the operating system and its major version, the screen you were on, the error type and the place in Stochastly’s own code of recent engine errors, and the last lines of the app and interface logs. Each log line keeps its time, level and component and is cut before any value; paths, email addresses, keys, network addresses, the computer name and the user name are removed before the dialog shows it.
- What a full crash report contains. The error type, the place in Stochastly’s own code where it happened, a fingerprint computed from those two, the app version and operating system, and the same kind of details block. Never the error message, the content of your files, prices, your strategy code, full file paths, environment variables, your computer name or your user name.
- Why, and on what basis. To find and fix the defects you report. A report is sent by your own action after you have seen it, or because you ticked the box: your consent (Art. 6(1)(a)). Each report is linked to your licence so that we can follow up with you; you can send up to five bug reports a day.
- Where it goes. Our Supabase database in the European Union (see who else processes it), readable by our server key alone, and shown to the Stochastly team in an administration page protected by a second factor. Our server log records that a report arrived, with its identifier, version, operating system and size, never its text. Linear receives a title, the version, the operating system and the fingerprint, never your text or the details.
- How long. Bug reports 24 months, full crash reports 90 days, the count of each crash fingerprint 12 months after its last report; then the database deletes them every day.
- Errors in the pages of stochastly.com. When a script of our website fails in your browser, the page sends the error type, the place in our own scripts (file, function, line), whether it was an error or a refused promise, and the page path without its query. Never the error message, what you typed, a file you dropped, a cookie or your IP address. They are counted by fingerprint with the crash groups above, kept 12 months after the last occurrence, and Linear receives a title, the site version and the fingerprint. To limit how many a single address can send, our server keeps a salted hash of the IP address in memory for at most a day, never on disk. Purpose: finding and fixing what breaks on the site; legal basis: our legitimate interest, Art. 6(1)(f).
- How to stop or erase. Do not press Send, or untick Attach these details to send your text alone. Untick the box in Settings and no crash report leaves on its own any more. To have reports you sent deleted earlier, write to contact@stochastly.com.

## Backtest checks on stochastly.com

When you check a backtest on [the app window of the home page](https://stochastly.com/#check), the CSV you drop or paste is sent to our server, read in memory to compute the report, and discarded when the answer is sent. It is not written to disk or to a database. The computed report is sent to Nebius Token Factory for a short assistant reading. We cache that reading and hashes of the file and report for up to 30 days. Daily reading limits use your account identifier if your session is valid, or a salted hash of your IP address. The raw IP address is not stored in these tables. Daily keys whose UTC date is more than two days old are removed by an hourly purge. Each check also adds one to a daily counter of CSV checks by outcome, page and range of rows, with no file, file name, figure, account or IP address; a check refused before it reaches our server is added by the window with the same three values. Purpose: knowing how many checks are run and how many fail; legal basis: our legitimate interest, Art. 6(1)(f); kept 25 months, then deleted by a daily job.

Until 16 October 2026, a computed report was published only if you pressed “Publish this report in the public CSV count”. No new report is published since then. The stored record of a published report holds the computed figures (Sharpe ratios, probabilities, moments, drawdown, the N and frequency you entered, the NOT CONCLUSIVE strategy verdict), the first and last date of the file, the day of publication, a random identifier and a hash of a deletion code. It holds no file, no series, no column name, no account, no email address and no IP address. Each published report keeps its public page at stochastly.com/check/r/ followed by its identifier, which search engines may index, and it counts in the totals of [the check method page](https://stochastly.com/check). You can delete it with the deletion code shown when it was published, or by writing to us with its address. Published reports are deleted after three years.

## How long we keep it

- Legacy waitlist emails. You can request removal of a previously submitted email address at contact@stochastly.com.
- Newsletter totals. Daily and weekly totals hold no email address and are kept as anonymous statistics; the records they are counted from follow the newsletter retention above.
- Shared verdicts (public research counter). Three years from the day of the run, then deleted as described under optional data sharing; earlier if you delete them from the app.
- Shared backtest descriptions (internal model training). Three years from receipt, then deleted as described under optional data sharing; earlier if you delete them from the app.
- Licence and purchase records. For the life of the licence, then 10 years, the period French law sets for accounting records (art. L. 123-22 of the French Commercial Code). A computer released from a licence is deleted from it at release.
- Creator program. Commissions and payouts are accounting records: 10 years after the year they are paid. Card fingerprints and referral records are kept while the program runs, so that a card or a customer is recognised on a later purchase.
- Licence check log. 12 months, then deleted by a daily job.
- Assistant counter. One row per licence per month, kept while the licence runs and for 3 years after it ends, as accounting and evidence records.
- Assistant daily counter. 35 days, then deleted by a daily job.
- Early access. Kept while your account exists. Deleting your account deletes your answers.
- Free trial. Kept for as long as we offer trials, so that one per person and per computer can be enforced. Deleting your account removes the link between the trial record and the account.
- Account. Until you ask us to delete it. Deleting the account does not end a licence: the licence record stays, detached from the account.
- Server logs. Our server keeps its system journal for at most one month. Our host and our network provider keep their own logs for the period they set, at most 12 months.
- Audience measurement. 25 months from the visit, then deleted by a monthly job.

## What you have to give us

An email address is required to create an account or join the early access, and the machine fingerprint is required to link a computer to it. Without them the contract cannot be performed. Other records are produced through use of the service or were submitted with consent you can withdraw.

## How it is protected

Every table listed above has row-level security enabled with no public policy, so the anonymous key reaches none of them and only our server key does. The key that signs licence tokens is held offline and never reaches the server. A second key, held by the server as a secret, signs the short-lived authorisation each linked computer receives. Licence tokens are signature-verified before any database row is touched.

## Your rights

Under the GDPR you may, at any time:

- access the data we hold about you, and ask us to correct it;
- ask us to erase it, or restrict or object to its processing;
- object to processing based on our legitimate interest, including the licence check log and the audience measurement (for the latter, Do Not Track or Global Privacy Control in your browser is enough);
- receive it in a portable format;
- withdraw a consent you gave, such as a legacy waitlist entry, by writing to us; withdrawal does not affect processing already carried out;
- lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr), or with the data protection authority of the country where you live, where its law allows it.

To exercise any of these rights, email contact@stochastly.com. Erasing a licence record ends the licence, because the record is what proves it.

## Changes

We update this policy as the service changes. The version in force is the one published at stochastly.com/privacy, under the date it carries.

## Public community profile

The profile is private by default. If you request publication and a moderator approves it, your handle, biography, optional affiliation, photograph, social links, approved papers and approved extensions become public and may be indexed by search engines. We process them to provide the community feature you request. Pending material is visible only to you and moderators. Reports and moderation decisions are recorded to handle notices and protect the service. You can disable publication or delete the profile and its hosted content from your account; search engines may keep cached copies outside our control.

Marketplace partner requests: when you send the form on the marketplace partners page, we store your company name, website, name, work email and message to answer you and discuss a possible integration, on the basis of our legitimate interest in replying to a business enquiry. Only the moderation team reads them. A request is kept while the discussion is open and for at most three years after the last contact, and you can ask us to delete it at any time.

---
Source: https://stochastly.com/privacy